Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Azure Domain Services

Step-by-Step Guide: Bulk import/remove group members from Azure Active Directory (Public Preview)

So far in Azure Active Directory, if we need to add members to a group, we have to go through a few steps. 

To remove members from a group, we have to select members manually and then remove it. 

This process is still okay for small scale changes. But if it is large scale change, it will take time. Also, engineers can make mistakes by selecting the wrong users. Microsoft now allows us to add and remove users based on CSV files. This is still in the preview stage but it is not too early to test. In this demo, I am going to demonstrate how we can add/remove Azure AD group members using CSV files. 

Add Members 

To add members to Azure AD group using the new CSV method, 

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator or Group Owner.

2. Go to Azure Active Directory | Groups  

3. In this demo, I am going to add users to "Leadership" group. So, I went ahead and click on it.  [Read more…] about Step-by-Step Guide: Bulk import/remove group members from Azure Active Directory (Public Preview)

Step-by-Step guide to enable Azure AD authentication for Azure Files

"Azure Files" is a managed, cloud-based file share that can access via SMB protocol. Once you create Azure File share it can be accessed from any ware using Windows, Linux or macOS. It can also map as a shared drive to a system. This can be used as a unified, reliable, simple solution to replace traditional file servers. 

In the on-premises Active Directory environment, we use NTFS permissions to control access to folders and file shares. If we are replacing traditional file shares with Azure Files, we need a way to manage access permissions to it in a similar manner. This is applicable if these folders are accessed via "Windows Virtual Desktop" or "Domain-Joined Azure VM". Azure File now supports Azure Active Directory Domain Services (Azure AD DS) authentication. Now we can create NTFS access control lists (ACLs) for Azure File Shares to control access permissions in a granular level. In this demo, we are going to look into this new feature in detail. 

To test this, we need following,

  • Valid Azure AD Subscription
  • Azure AD Domain Services on the Azure AD tenant – We need Azure AD Domain Services enabled for the Azure AD tenant. 
  • Domain-Joined Azure VM – This need to be added to the Azure AD Domain Services

In my demo setup, I already have a managed domain called rebeladmlive.onmicrosoft.com

I also have a domain-joined VM called SRV01 which I will be using for the testing. 

[Read more…] about Step-by-Step guide to enable Azure AD authentication for Azure Files

How Azure AD Seamless Single Sign-On (SSO) Works?

There are 3 different methods which we can use to integrate on-premises Active Directory with Azure AD. 

• Pass Password hash synchronization

• Federation using Microsoft AD FS or PingFederate

• Pass-through Authentication 

All above methods allow on-premises users to use their existing domain user names and passwords in order to authenticate in to Azure AD integrated services. However, even users can use same user name and passwords, when they access Azure AD integrated services from corporate device (Domain member), they still have to authenticate via sign in page. Azure AD Seamless SSO allow users to access Azure AD integrated services via corporate devices without re-authentication. Azure AD Seamless SSO can use with password hash synchronization and pass-through authentication method. It is not supported to use with federated authentication method (AD FS already capable of provide SSO).

• Azure AD Seamless SSO feature can enable via Azure AD connect. So, it is not required any additional component in environment. 

• This is a free feature. We do not need to pay anything for it.

• Azure AD Seamless SSO works only in domain-joined devices (no need to be Azure AD join)

• If SSO process is fail for any reason, user can still authenticate using user name and password.

• It is supported to work with browser-based web applications and Office 365 clients with app versions 16.0.8730 and above.

• Azure AD Seamless SSO accepts user names as value associated with userPrincipalName attribute or Azure AD connect Alternate ID attribute. 

• Azure AD Seamless SSO uses the securityIdentifier claim in the Kerberos ticket to find the relevant user object in Azure AD.

• Once Azure AD Seamless SSO is enabled, if an application can forward domain_hint (OpenID Connect) or whr (SAML) parameter to identify tenant and login_hint (OpenID Connect) parameter to identify user, we can log in to Azure AD without typing user names. It is also possible if the application uses unique URL and pass the domain info or tenant info. 

• Once user is logged in via SSO, if required user can still sign out and log in as a different user at any time.  [Read more…] about How Azure AD Seamless Single Sign-On (SSO) Works?

Step-by-Step Guide to Restrict Azure AD Administration portal

In order to manage Azure AD, we use Azure Active Directory option in https://portal.azure.com. By default, any user under Azure AD can access this option event they do not have a Directory role. In my demo setup, I have a user called "Emily Braun". She doesn't have any Directory role assigned. 

Then I log in to Azure portal https://portal.azure.com as the user and then go to Azure Active Directory option. It didn't block me accessing it. 

I can go to All users and see user account details. 

I even can see the Groups memberships details. 

 

Also, can view application assignments. 

As an end user I also can see the Azure AD Connect details. 

[Read more…] about Step-by-Step Guide to Restrict Azure AD Administration portal

Step-by-Step Guide : Azure AD B2B Email one-time passcode authentication (preview)

Azure AD B2B allows organizations to share company applications and other services/resources with external users. Before, this external user should have one of following to initiate connection with the organization who sents the B2B inivitation. 

1) Azure AD Account

2) Microsoft Account

3) Google Federation ( More info : https://www.rebeladmin.com/2019/02/step-step-guide-setup-federation-google-azure-ad-b2b/ )

Email one-time passcode authentication (OTP) feature now allow B2B users to authenticate using one time passcode if they cant use one of the above methods. Once OTP is issued it is only valid for 30 minutes. If user didn’t use it with in 30 minutes, he/she need to request new OTP code for authentication. Once authenticated, session will be valid for 24 hours.  

This feature is still under public preview. OTP users must use the https://myapps.microsoft.com/?tenantid=<tenant id> , https://portal.azure.com/<tenant id> or https://myapps.microsoft.com/<verified domain>.onmicrosoft.com when they authenticate. In above <tenant id> should replaced with the organization’s tenant ID. <verified domain> should replace using the default domain details. 

You can find the tenant id using, 

Azure Portal | Azure Active Directory | Properties | Directory ID  

Let’s see how we can enable this new OTP feature. 

To do that,

1) Log in to Azure portal as Global Administrator

2) Go to Azure Active Directory | Organizational relationships 

3) Then go to Settings

[Read more…] about Step-by-Step Guide : Azure AD B2B Email one-time passcode authentication (preview)